On August 17, 2026, Germany's Bundeskartellamt declared binding a set of Apple commitments on App Tracking Transparency (ATT) and closed its proceeding. The case ran under Section 19a of the German Competition Act (GWB) and Article 102 TFEU. It began in June 2022. The outcome is a design remedy. It carries no fine, and it matters more as a template than as a one-off.
The strongest case for the regulator
The complaint was not that Apple protects privacy. The Bundeskartellamt objected that Apple built different consent requests for its own services and for third-party apps. Third-party apps faced the ATT prompt, which the authority argued steered users toward refusal. Apple's own services used a differently designed prompt that encouraged consent. The result was a rule that looks neutral but puts rivals at a structural disadvantage in advertising, where consent rates decide revenue.
That is a legitimate competition concern. Apple controls the operating system, the dialog and the default wording. A firm in that position can shape user choices without ever breaking a data-protection rule. Section 19a exists for gatekeepers of this kind. It lets the authority intervene before a dominant position is entrenched, without proving a full abuse case years later.
What Apple agreed to
According to the Bundeskartellamt, Apple will align the consent prompts for its own offerings and for third-party apps much more closely. It will remove possibly discouraging symbols and wording from its predefined requests. Apps will get more room to explain personalised advertising and to combine the ATT request with their own data-protection consent. Per the Bundeskartellamt's account, the changes run for seven years and are overseen by an independent monitoring trustee. They must be made within four months of formal service of the decision.
The geographic scope is reported inconsistently. MacRumors reports the changes apply only in Germany. The Next Web says they apply across nearly all of the EU. Other coverage describes them as tied to users with German billing addresses and devices in Germany. The Bundeskartellamt's own release frames the case as German proceedings, and we could not confirm a wider scope from it. Readers should treat any EU-wide claim as unconfirmed until Apple's implementation notice is public.
President Andreas Mundt framed the principle narrowly: Apple "is allowed to provide for a level of protection for its users that exceeds minimum legal requirements," but extra rules within its ecosystem "must not treat its own offerings better than those of its competitors."
Why the remedy is better than a penalty
France took a different route. In decision 25-D-02 of March 28, 2025, the Autorité de la concurrence fined Apple €150 million for abusing a dominant position. It found that ATT's objective was not problematic in itself, but that its implementation was neither necessary nor proportionate to the stated aim of protecting personal data. The Next Web reports a further €98.6 million penalty in Italy.
Fines punish past conduct and leave the interface unchanged. A binding commitment changes the thing users actually see. It also keeps the privacy feature, which millions of users value, rather than treating it as the problem. A rule that says "keep the protection, remove the thumb on the scale" is easier to defend as proportionate than one that signals regulators distrust privacy tooling at all.
The process also did better than most on evidence. The Bundeskartellamt issued a preliminary assessment in February 2025 and ran a market test announced on December 2, 2025. Participants included app publishers, media and advertising associations, and Germany's data-protection authorities, the BfDI and BayLDA. The authority then asked for further amendments before making the commitments binding. That sequence is slow, at about four years. But it produced a remedy tested against the people it affects.
Where the approach is still weak
Three cautions apply.
- Speed. Four years is long in mobile advertising. Apple introduced ATT in 2021, and the market has changed since. A tool that takes this long will rarely help a startup that is hurt now.
- Measurement left alone. Per the market-test release, Apple did not propose changing how it measures advertising success, and said it will continue that practice without prior user consent. Whether that is an acceptable asymmetry is a fair open question that this settlement does not answer.
- Fragmentation. If the changes apply in Germany only, developers face one consent flow in Germany and another elsewhere. Compliance costs fall hardest on small publishers. Parallel national cases in France, Italy and Germany produce this patchwork because no single authority resolves the question for the single market.
What policymakers should take from it
The case supports a calibrated reading of Section 19a. Intervene on specific design choices where a gatekeeper's own services get better treatment. Prefer commitments that can be audited by a trustee. Leave the underlying privacy objective alone. That is more innovation-friendly than blanket bans on platform features, and more protective of users than doing nothing.
The test comes after the four-month window. Neutral wording should mean opt-in rates for Apple's own prompt and third-party prompts converge. If the trustee publishes data on that, regulators elsewhere will have evidence to copy or reject. If it does not, the seven-year commitment will be harder to judge from outside.